mcp-browser-extension 0.9.30 → 0.9.32

package/extension-dist/background.js

@@ -1,5 +1,41 @@
 "use strict";
 (() => {
+  // shared/client-auth.ts
+  var CLIENT_APPROVAL_CAP = "client-approval-v1";
+  var CLIENT_GRANT_MS = 8 * 60 * 60 * 1e3;
+  var CLIENT_CLOCK_SKEW_MS = 2 * 60 * 1e3;
+  var CLIENT_REQUEST_MS = 10 * 60 * 1e3;
+  var CLIENT_STORAGE_KEY = "clientConnections";
+  function clientName(value) {
+    return value.replace(/[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/g, "").trim().slice(0, 80) || "Unnamed app";
+  }
+  function canonical(value) {
+    if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+    if (value && typeof value === "object") {
+      const obj = value;
+      return `{${Object.keys(obj).sort().map((k) => `${JSON.stringify(k)}:${canonical(obj[k])}`).join(",")}}`;
+    }
+    return JSON.stringify(value);
+  }
+  function clientSigningPayload(cmd, proof) {
+    return canonical(JSON.parse(JSON.stringify({
+      domain: CLIENT_APPROVAL_CAP,
+      v: cmd.v,
+      method: cmd.method,
+      params: cmd.params,
+      tabId: cmd.tabId ?? null,
+      timeoutMs: cmd.timeoutMs,
+      publicKey: proof.publicKey,
+      name: proof.name,
+      challenge: proof.challenge,
+      issuedAt: proof.issuedAt,
+      nonce: proof.nonce
+    })));
+  }
+  function isHealthProbe(cmd) {
+    return cmd.method === "ping_probe" && Object.keys(cmd.params ?? {}).length === 0;
+  }
+
   // shared/protocol.ts
   var PROTOCOL_VERSION = 1;
   var CLOSE_SUPERSEDED = 4e3;
@@ -40,6 +76,338 @@
     "ping_probe"
   ];
 
+  // extension/src/sw/cmd-error.ts
+  var CmdError = class extends Error {
+    constructor(code, message) {
+      super(message);
+      this.code = code;
+    }
+    code;
+  };
+
+  // extension/src/sw/client-approvals.ts
+  var MAX_CLIENTS = 64;
+  var MAX_NONCES = 4096;
+  var MAX_QUEUED_COMMANDS = 64;
+  var denied = (message) => {
+    throw new CmdError("POLICY_DENIED", message);
+  };
+  function decode(value) {
+    const raw = atob(value);
+    return Uint8Array.from(raw, (c) => c.charCodeAt(0));
+  }
+  var ClientApprovals = class {
+    constructor(deps) {
+      this.deps = deps;
+      this.now = deps.now ?? Date.now;
+    }
+    deps;
+    clients = [];
+    loaded = false;
+    storageFault = false;
+    revokingAll = false;
+    queuedCommands = 0;
+    revoking = /* @__PURE__ */ new Set();
+    queue = Promise.resolve();
+    nonces = /* @__PURE__ */ new Map();
+    now;
+    serial(fn) {
+      const result = this.queue.then(fn);
+      this.queue = result.catch(() => void 0);
+      return result;
+    }
+    async load() {
+      if (this.loaded) return;
+      const saved = await this.deps.read();
+      if (saved !== void 0 && (!Array.isArray(saved) || saved.length > MAX_CLIENTS || saved.some((c) => !c || typeof c.id !== "string" || !/^[a-f0-9]{64}$/.test(c.id) || typeof c.publicKey !== "string" || typeof c.name !== "string" || !["pending", "approved", "revoked"].includes(c.state) || !Number.isFinite(c.requestedAt) || !Number.isFinite(c.expiresAt)))) {
+        denied("Client approval storage is invalid. Browser access is blocked.");
+      }
+      this.clients = saved ?? [];
+      this.loaded = true;
+      this.deps.changed?.(this.clients);
+    }
+    async save(clients) {
+      await this.deps.write(clients);
+      this.clients = clients;
+      this.deps.changed?.(clients);
+    }
+    /** The returned check runs again immediately before execution, after tab/policy awaits. */
+    async authorize(cmd, verified) {
+      if (isHealthProbe(cmd)) return () => void 0;
+      if (this.queuedCommands >= MAX_QUEUED_COMMANDS) return denied("Too many pending client commands. Retry after the current commands finish.");
+      this.queuedCommands++;
+      return this.serial(async () => {
+        if (this.storageFault) return denied("Client approval storage failed. Save the decision again in the extension popup or Settings before continuing.");
+        try {
+          await this.load();
+        } catch {
+          return denied("Cannot load client approvals. Browser access is blocked.");
+        }
+        const p = cmd.authorization;
+        const now = this.now();
+        if (cmd.v !== PROTOCOL_VERSION || !p || typeof p.publicKey !== "string" || p.publicKey.length !== 124 || typeof p.signature !== "string" || p.signature.length !== 88 || typeof p.name !== "string" || p.name !== clientName(p.name) || typeof p.nonce !== "string" || !/^[a-f0-9-]{36}$/.test(p.nonce) || !Number.isSafeInteger(p.issuedAt) || Math.abs(now - p.issuedAt) > CLIENT_CLOCK_SKEW_MS || !this.deps.challenge() || p.challenge !== this.deps.challenge()) {
+          return denied("Client authorization is missing, stale or invalid. Update the server and extension, then reconnect.");
+        }
+        let id;
+        try {
+          const der = decode(p.publicKey);
+          const key = await crypto.subtle.importKey("spki", der, { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
+          const valid = await crypto.subtle.verify(
+            { name: "ECDSA", hash: "SHA-256" },
+            key,
+            decode(p.signature),
+            new TextEncoder().encode(clientSigningPayload(cmd, p))
+          );
+          if (!valid) return denied("Client signature is invalid. Browser access is blocked.");
+          id = Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256", der)), (b) => b.toString(16).padStart(2, "0")).join("");
+        } catch {
+          return denied("Client signature is invalid. Browser access is blocked.");
+        }
+        let client = this.clients.find((c) => c.id === id);
+        if (client && (client.publicKey !== p.publicKey || client.name !== p.name)) {
+          return denied("Client identity changed. Start a new connection and approve it in Chrome.");
+        }
+        verified?.(id, p.name);
+        if (this.revokingAll) return denied("Browser access is being stopped.");
+        if (this.revoking.has(id) || client?.state === "revoked") return denied(`Client access was revoked (${id.slice(0, 12)}). Only you can restore it in the extension popup or Settings.`);
+        if (!client || client.expiresAt <= now) {
+          const live = this.clients.filter((c) => c.id !== id && c.expiresAt > now);
+          if (live.length >= MAX_CLIENTS) return denied("Too many client connections. Remove access for unused apps in the extension popup or Settings and retry later.");
+          client = { id, publicKey: p.publicKey, name: p.name, state: "pending", requestedAt: now, expiresAt: now + CLIENT_REQUEST_MS };
+          try {
+            await this.save([...live, client]);
+          } catch {
+            return denied("Cannot save the approval request. Browser access is blocked.");
+          }
+        }
+        for (const [clientId, seen2] of this.nonces) {
+          for (const [nonce, expires] of seen2) if (expires < now) seen2.delete(nonce);
+          if (!seen2.size) this.nonces.delete(clientId);
+        }
+        let seen = this.nonces.get(id);
+        if (!seen) {
+          seen = /* @__PURE__ */ new Map();
+          this.nonces.set(id, seen);
+        }
+        if (seen.has(p.nonce)) return denied("Replayed client command refused.");
+        if (seen.size >= MAX_NONCES) return denied("Too many client commands from this app. Wait two minutes and retry.");
+        seen.set(p.nonce, p.issuedAt + CLIENT_CLOCK_SKEW_MS);
+        if (client.state !== "approved") {
+          return denied(`Please approve "${client.name}" (check key ${id.slice(0, 12)}): Chrome \u2192 MCP Browser Extension icon \u2192 App connections \u2192 Approve for 8 hours.`);
+        }
+        const authorizedGrant = client;
+        const check = () => {
+          const grant = this.clients.find((c) => c.id === id);
+          if (this.storageFault || this.revokingAll || this.revoking.has(id) || p.challenge !== this.deps.challenge() || grant !== authorizedGrant || grant.state !== "approved" || grant.expiresAt <= this.now()) {
+            denied("Client access expired, was revoked or disconnected. Approve the connection in Chrome before retrying.");
+          }
+        };
+        check();
+        return check;
+      }).finally(() => {
+        this.queuedCommands--;
+      });
+    }
+    revokeAll() {
+      this.revokingAll = true;
+      return this.serial(async () => {
+        try {
+          await this.load();
+          this.clients = this.clients.map((c) => ({ ...c, state: "revoked", expiresAt: this.now() + CLIENT_GRANT_MS }));
+          await this.save(this.clients);
+          this.storageFault = false;
+          this.revokingAll = false;
+        } catch (err) {
+          this.storageFault = true;
+          throw err;
+        }
+      });
+    }
+    /** Called exclusively by messages from the extension's own approval UI. */
+    decide(id, allow) {
+      if (!allow) this.revoking.add(id);
+      return this.serial(async () => {
+        await this.load();
+        const client = this.clients.find((c) => c.id === id);
+        if (!client) {
+          this.revoking.delete(id);
+          return denied("That connection no longer exists.");
+        }
+        if (allow && client.state === "pending" && client.expiresAt <= this.now()) {
+          return denied("This request expired. Retry the tool to request access again.");
+        }
+        const next = { ...client, state: allow ? "approved" : "revoked", expiresAt: this.now() + CLIENT_GRANT_MS };
+        if (!allow) this.clients = this.clients.map((c) => c.id === id ? next : c);
+        try {
+          await this.save(this.clients.map((c) => c.id === id ? next : c));
+          this.storageFault = false;
+          this.revoking.delete(id);
+        } catch (err) {
+          this.storageFault = true;
+          throw err;
+        }
+      });
+    }
+  };
+  function isApprovalPage(sender) {
+    return sender.id === chrome.runtime.id && [chrome.runtime.getURL("options.html"), chrome.runtime.getURL("popup.html")].includes(sender.url ?? "") && (sender.frameId === void 0 || sender.frameId === 0);
+  }
+
+  // shared/activity.ts
+  var ACCESS_STOPPED_KEY = "accessStopped";
+  var ACTIVITY_KEY = "recentActivity";
+  var ACTIVITY_LIMIT = 100;
+  function activityHost(url) {
+    if (url === "about:blank") return url;
+    if (url === "chrome://newtab/" || url === "chrome://newtab" || url === "chrome://new-tab-page/") return "chrome://newtab";
+    try {
+      const parsed = new URL(url);
+      return ["http:", "https:"].includes(parsed.protocol) ? parsed.hostname.slice(0, 253) : "";
+    } catch {
+      return "";
+    }
+  }
+  function activityEntry(value) {
+    return {
+      id: value.id.slice(0, 80),
+      at: value.at,
+      method: WIRE_METHODS.includes(value.method) ? value.method : "unknown",
+      host: activityHost(value.host) || activityHost(`https://${value.host}/`),
+      ...Number.isSafeInteger(value.tabId) && value.tabId >= 0 ? { tabId: value.tabId } : {},
+      app: value.key ? clientName(value.app) : "Unverified app",
+      key: /^[a-f0-9]{64}$/.test(value.key) ? value.key : "",
+      outcome: ["running", "done", "blocked", "failed", "interrupted"].includes(value.outcome) ? value.outcome : "failed"
+    };
+  }
+
+  // extension/src/sw/access-switch.ts
+  var AccessSwitch = class {
+    constructor(deps) {
+      this.deps = deps;
+    }
+    deps;
+    stopped = true;
+    loaded = false;
+    epoch = 0;
+    queue = Promise.resolve();
+    serial(fn) {
+      const result = this.queue.then(fn);
+      this.queue = result.catch(() => void 0);
+      return result;
+    }
+    initialize() {
+      return this.serial(async () => {
+        if (this.loaded) return;
+        const epoch = this.epoch;
+        const saved = await this.deps.read();
+        if (epoch !== this.epoch || this.epoch !== 0) return;
+        this.stopped = saved !== void 0 && saved !== false;
+        this.loaded = true;
+      });
+    }
+    check() {
+      const epoch = this.epoch;
+      const check = () => {
+        if (!this.loaded || this.stopped || epoch !== this.epoch) {
+          throw new CmdError("POLICY_DENIED", "Browser access is stopped. Use Resume connection in the extension popup or Settings, then approve your app again.");
+        }
+      };
+      check();
+      return check;
+    }
+    stop() {
+      this.stopped = true;
+      this.epoch++;
+      this.deps.disconnect();
+      return this.serial(async () => {
+        await this.deps.write(true);
+        this.loaded = true;
+        await this.deps.revoke();
+      });
+    }
+    resume() {
+      const epoch = this.epoch;
+      return this.serial(async () => {
+        if (epoch !== this.epoch) return;
+        this.stopped = true;
+        await this.deps.write(true);
+        await this.deps.revoke();
+        if (epoch !== this.epoch) return;
+        await this.deps.write(false);
+        if (epoch !== this.epoch) {
+          await this.deps.write(true);
+          return;
+        }
+        this.loaded = true;
+        this.stopped = false;
+      });
+    }
+  };
+
+  // extension/src/sw/activity.ts
+  var ActivityLog = class {
+    constructor(deps) {
+      this.deps = deps;
+    }
+    deps;
+    queue = Promise.resolve();
+    entries = [];
+    loaded = false;
+    generation = 0;
+    pending = 0;
+    serial(fn) {
+      const result = this.queue.then(fn);
+      this.queue = result.catch(() => void 0);
+      return result;
+    }
+    async load() {
+      if (this.loaded) return;
+      const saved = await this.deps.read();
+      this.entries = (Array.isArray(saved) ? saved : []).filter(
+        (v) => v && typeof v.id === "string" && Number.isFinite(v.at) && typeof v.method === "string" && typeof v.host === "string" && typeof v.app === "string" && typeof v.key === "string"
+      ).slice(-ACTIVITY_LIMIT).map((v) => activityEntry({
+        ...v,
+        outcome: v.outcome === "running" ? "interrupted" : v.outcome
+      }));
+      this.loaded = true;
+    }
+    /** Clear history also prevents already-running requests from reappearing. */
+    token() {
+      return this.generation;
+    }
+    record(entry, generation = this.generation) {
+      if (this.pending >= 256) return Promise.reject(new Error("Activity history is busy."));
+      this.pending++;
+      const safe = activityEntry(entry);
+      return this.serial(async () => {
+        if (generation !== this.generation) return;
+        await this.load();
+        const next = this.entries.filter((e) => e.id !== safe.id);
+        next.push(safe);
+        next.sort((a, b) => a.at - b.at);
+        this.entries = next.slice(-ACTIVITY_LIMIT);
+        await this.deps.write(this.entries);
+      }).finally(() => {
+        this.pending--;
+      });
+    }
+    clear() {
+      this.generation++;
+      return this.serial(async () => {
+        await this.deps.write([]);
+        this.entries = [];
+        this.loaded = true;
+      });
+    }
+    interrupt() {
+      return this.serial(async () => {
+        await this.load();
+        this.entries = this.entries.map((e) => e.outcome === "running" ? { ...e, outcome: "interrupted" } : e);
+        await this.deps.write(this.entries);
+      });
+    }
+  };
+
   // extension/src/sw/ws-client.ts
   function chromeVersion() {
     const m = /Chrome\/(\d+)/.exec(navigator.userAgent);
@@ -52,6 +420,7 @@
     deps;
     ws = null;
     state = "idle";
+    approvalChallenge = "";
     isConnected() {
       return this.state === "connected" && this.ws?.readyState === WebSocket.OPEN;
     }
@@ -68,11 +437,14 @@
         return;
       }
       this.ws = ws2;
+      this.approvalChallenge = crypto.randomUUID();
       ws2.onopen = () => {
+        if (this.ws !== ws2) return;
         const hello = {
           type: "hello",
           v: PROTOCOL_VERSION,
           token,
+          approvalChallenge: this.approvalChallenge,
           ext: { id: chrome.runtime.id, version: chrome.runtime.getManifest().version, chrome: chromeVersion() },
           profile: profile && profile.trim() ? profile.trim() : void 0,
           installId,
@@ -80,11 +452,12 @@
           // This build gates fail-closed and reports tab URLs on results, so the
           // server may skip its pre-flight tabs_list. An older build omits this and
           // the server keeps fetching the URL itself.
-          caps: [WIRE_CAP_TAB_URL, WIRE_CAP_FILL_FORM, WIRE_CAP_PROXY]
+          caps: [WIRE_CAP_TAB_URL, WIRE_CAP_FILL_FORM, WIRE_CAP_PROXY, CLIENT_APPROVAL_CAP]
         };
         ws2.send(JSON.stringify(hello));
       };
       ws2.onmessage = (ev) => {
+        if (this.ws !== ws2) return;
         let frame;
         try {
           frame = JSON.parse(typeof ev.data === "string" ? ev.data : "");
@@ -108,7 +481,13 @@
             this.send({ type: "pong", v: PROTOCOL_VERSION, ts: frame.ts });
             break;
           case "command":
-            this.deps.onCommand(frame);
+            if (this.state === "connected" && frame.v === PROTOCOL_VERSION) {
+              this.deps.onCommand(frame, (result) => {
+                if (this.ws === ws2 && this.state === "connected" && ws2.readyState === WebSocket.OPEN) {
+                  ws2.send(JSON.stringify(result));
+                }
+              });
+            }
             break;
           case "policy":
             this.deps.onPolicy(frame.policy);
@@ -121,8 +500,10 @@
       };
       ws2.onclose = (ev) => {
         const current = this.ws === ws2;
-        if (current) this.ws = null;
-        if (current && ev.code === CLOSE_SUPERSEDED) {
+        if (!current) return;
+        this.ws = null;
+        this.approvalChallenge = "";
+        if (ev.code === CLOSE_SUPERSEDED) {
           this.setState("superseded");
           this.deps.log("another browser paired under the same profile name took this connection");
         } else if (this.state !== "unauthorized" && this.state !== "superseded") {
@@ -144,6 +525,7 @@
       } catch {
       }
       this.ws = null;
+      this.approvalChallenge = "";
     }
     setState(state, detail) {
       this.state = state;
@@ -210,15 +592,14 @@
   }
   function normalizeDomainPattern(pattern) {
     let p = pattern.trim().toLowerCase();
-    if (p === "*" || p === "*://*/*") return "*";
+    if (p === "*" || p === "*://*/*" || p === "<all_urls>") return "";
     p = p.replace(/^[a-z][a-z0-9+.-]*:\/\//, "");
     p = p.replace(/[/?#].*$/, "");
     p = p.replace(/^[^@]*@/, "").replace(/:\d+$/, "");
-    return p;
+    return p === "*" || p === "*." ? "" : p;
   }
   function globMatches(host, pattern) {
     const p = normalizeDomainPattern(pattern);
-    if (p === "*") return true;
     if (p.startsWith("*.")) {
       const base = p.slice(2);
       return host === base || host.endsWith("." + base);
@@ -259,14 +640,12 @@
     if (isAboutBlank(url) && NAVIGATION.has(method)) return { ok: true };
     if (!isDomainAllowed(url, policy)) {
       const host = hostOf(url) || url;
-      return { ok: false, reason: blockedDomainMessage(method, host, policy) };
+      return { ok: false, reason: blockedDomainMessage(host) };
     }
     return { ok: true };
   }
-  function blockedDomainMessage(method, host, policy) {
-    const allowed = policy.allowDomains.filter((d) => d !== "*");
-    const allowedLine = allowed.length ? `Currently allowed: ${allowed.join(", ")}.` : `Right now no sites are allowed.`;
-    return `Blocked: "${method}" can't run on ${host} because it isn't on this browser tool's allowed-sites list. This is a safety limit (the tool drives your real, logged-in browser, so it only touches sites you've approved) \u2014 not an error. ${allowedLine} To allow ${host} right now, ask the user to click the MCP Browser Extension's toolbar icon in Chrome and click Allow next to ${host}: it applies at once, no restart. You cannot approve a site yourself. Or add --allow-domain "${host}" (or "*.${host}" to include subdomains) to the MCP Browser Extension server settings (its entry in your MCP config) and restart. To allow every site (less safe), use --unsafe-all-domains.`;
+  function blockedDomainMessage(host) {
+    return `Please allow access to ${host}: Chrome \u2192 MCP Browser Extension icon \u2192 Allow next to ${host}, then try again.`;
   }
 
   // shared/fill-form.ts
@@ -909,7 +1288,6 @@
     for (const raw of policy.allowDomains ?? []) {
       const p = normalizeDomainPattern(raw);
       if (!p) continue;
-      if (p === "*") return ["<all_urls>"];
       out.add(`*://${p}/*`);
     }
     return [...out];
@@ -922,12 +1300,20 @@
   var MAX_CAPTURE_PX = 16384;
   function planScreenshot(dims, opts = {}) {
     const dpr = dims.dpr && dims.dpr > 0 ? dims.dpr : 1;
+    const zoom = dims.zoom && dims.zoom > 0 ? dims.zoom : 1;
     const scale = (opts.scale && opts.scale > 0 ? opts.scale : DEFAULT_SCREENSHOT_SCALE) / dpr;
+    const clip = (x, y, width, height) => ({
+      x: x * zoom,
+      y: y * zoom,
+      width: width * zoom,
+      height: height * zoom,
+      scale
+    });
     if (opts.element) {
       const realH = Math.max(1, Math.round(opts.element.h));
       const clipH = Math.min(opts.element.h, MAX_CAPTURE_PX);
       return {
-        clip: { x: opts.element.x, y: opts.element.y, width: opts.element.w, height: clipH, scale },
+        clip: clip(opts.element.x, opts.element.y, opts.element.w, clipH),
         captureBeyondViewport: true,
         width: Math.max(1, Math.round(opts.element.w)),
         height: Math.min(realH, MAX_CAPTURE_PX),
@@ -938,7 +1324,7 @@
     if (opts.fullPage) {
       const clipH = Math.min(dims.fullH, MAX_CAPTURE_PX);
       return {
-        clip: { x: 0, y: 0, width: dims.fullW, height: clipH, scale },
+        clip: clip(0, 0, dims.fullW, clipH),
         captureBeyondViewport: true,
         width: dims.fullW,
         height: clipH,
@@ -947,7 +1333,7 @@
       };
     }
     return {
-      ...scale !== 1 ? { clip: { x: dims.scrollX ?? 0, y: dims.scrollY ?? 0, width: dims.w, height: dims.h, scale } } : {},
+      ...scale !== 1 || zoom !== 1 ? { clip: clip(dims.scrollX ?? 0, dims.scrollY ?? 0, dims.w, dims.h) } : {},
       captureBeyondViewport: false,
       width: dims.w,
       height: dims.h,
@@ -1000,6 +1386,34 @@
     };
   }
 
+  // shared/browser-permissions.ts
+  function siteOrigins(input) {
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(input) && !/^https?:\/\//i.test(input)) return [];
+    const pattern = normalizeDomainPattern(input);
+    const host = pattern.startsWith("*.") ? pattern.slice(2) : pattern;
+    if (!host || host.length > 253 || !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/.test(host)) return [];
+    return [`http://${pattern}/*`, `https://${pattern}/*`];
+  }
+  function originForUrl(url) {
+    try {
+      const parsed = new URL(url);
+      return /^https?:$/.test(parsed.protocol) ? `${parsed.protocol}//${parsed.hostname}/*` : null;
+    } catch {
+      return null;
+    }
+  }
+  function isGlobalOrigin(origin) {
+    return origin === "<all_urls>" || /^(?:\*|[a-z]+):\/\/\*\/.*$/i.test(origin);
+  }
+  var OPTIONAL_FEATURES = {
+    cookies: { label: "Cookies", explanation: "Read cookies on websites you have allowed. Cookie values still follow your server settings." },
+    downloads: { label: "Downloads", explanation: "Save files from websites you have allowed." }
+  };
+  var FEATURE_REQUESTS_KEY = "browserPermissionRequests";
+  var PERMISSIONS_MIGRATION_KEY = "optionalBrowserPermissionsV1";
+  var PROXY_AUTH_PERMISSIONS = ["webRequest", "webRequestAuthProvider"];
+  var IP_LOOKUP_ORIGINS = ["https://ipinfo.io/*", "https://api.ipify.org/*"];
+
   // extension/src/sw/proxy.ts
   var BYPASS = ["127.0.0.1", "localhost", "[::1]", "<local>"];
   var IP_LOOKUPS = [
@@ -1032,6 +1446,7 @@
     else await setting.clear({});
   }
   async function applyProxy(log) {
+    if (!await chrome.permissions.contains({ permissions: ["proxy"] })) return;
     const cfg = await loadProxyConfig();
     if (cfg?.enabled) {
       await chrome.proxy.settings.set({
@@ -1070,6 +1485,9 @@
     });
   }
   async function lookupExitIp() {
+    if (!await chrome.permissions.contains({ origins: IP_LOOKUP_ORIGINS })) {
+      return { exitIp: null, error: "Please open Settings \u2192 Proxy \u2192 Check IP to allow the IP lookup." };
+    }
     let lastError = "lookup failed";
     for (const svc of IP_LOOKUPS) {
       try {
@@ -1091,6 +1509,17 @@
   }
   async function proxyStatus() {
     const cfg = await loadProxyConfig();
+    if (!await chrome.permissions.contains({ permissions: ["proxy"] })) {
+      return {
+        enabled: false,
+        server: null,
+        auth: false,
+        control: "not_granted",
+        webrtcProtected: false,
+        exitIp: null,
+        error: "Proxy permission is off. To use it, open Settings \u2192 Proxy \u2192 Save proxy."
+      };
+    }
     const current = await readSetting(chrome.proxy.settings, { incognito: false });
     const webrtcProtected = await hasPrivacyPermission() && (await readSetting(chrome.privacy.network.webRTCIPHandlingPolicy, {})).value === "disable_non_proxied_udp";
     return {
@@ -1103,15 +1532,52 @@
     };
   }
 
+  // extension/src/sw/browser-permissions.ts
+  var initialization;
+  function initializeBrowserPermissions() {
+    return initialization ??= (async () => {
+      await removeGlobalOrigins();
+      const saved = await chrome.storage.local.get([PERMISSIONS_MIGRATION_KEY, PROXY_STORAGE_KEY]);
+      if (!saved[PERMISSIONS_MIGRATION_KEY]) {
+        const permissions = ["cookies", "downloads"];
+        if (!parseProxyConfig(saved[PROXY_STORAGE_KEY])?.enabled) permissions.push(...PROXY_AUTH_PERMISSIONS);
+        await chrome.permissions.remove({ permissions });
+        await chrome.storage.local.set({ [PERMISSIONS_MIGRATION_KEY]: true });
+      }
+    })();
+  }
+  async function removeGlobalOrigins() {
+    const all = await chrome.permissions.getAll();
+    const origins = (all.origins ?? []).filter(isGlobalOrigin);
+    if (origins.length) await chrome.permissions.remove({ origins });
+    const remaining = await chrome.permissions.getAll();
+    if (remaining.origins?.some(isGlobalOrigin)) throw new Error("Please remove all-site access in Chrome before continuing.");
+  }
+  async function requireSitePermission(url) {
+    await initializeBrowserPermissions();
+    if (url === "about:blank") return;
+    const origin = originForUrl(url);
+    if (origin && await chrome.permissions.contains({ origins: [origin] })) return;
+    throw new CmdError("POLICY_DENIED", blockedDomainMessage(hostOf(url) || url));
+  }
+  var requestWrite = Promise.resolve();
+  async function requireFeaturePermission(feature) {
+    await initializeBrowserPermissions();
+    if (await chrome.permissions.contains({ permissions: [feature] })) return;
+    const write = requestWrite.then(async () => {
+      const saved = (await chrome.storage.local.get(FEATURE_REQUESTS_KEY))[FEATURE_REQUESTS_KEY];
+      const requests = Array.isArray(saved) ? saved.filter((x) => typeof x === "string" && x in OPTIONAL_FEATURES) : [];
+      await chrome.storage.local.set({ [FEATURE_REQUESTS_KEY]: [.../* @__PURE__ */ new Set([...requests, feature])] });
+    });
+    requestWrite = write.catch(() => void 0);
+    await write;
+    const label = OPTIONAL_FEATURES[feature].label;
+    throw new CmdError("POLICY_DENIED", `Please allow ${label.toLowerCase()}: Chrome \u2192 MCP Browser Extension icon \u2192 Extra permissions \u2192 Allow ${label.toLowerCase()}, then try again.`);
+  }
+
   // extension/src/sw/executor.ts
-  var CmdError = class extends Error {
-    constructor(code, message) {
-      super(message);
-      this.code = code;
-    }
-    code;
-  };
   var DOWNLOAD_TIMEOUT_MS = 12e4;
+  var MAX_DOWNLOAD_BYTES2 = 50 * 1024 * 1024;
   function waitForDownloadComplete(id) {
     return new Promise((resolve, reject) => {
       let settled = false;
@@ -1183,6 +1649,7 @@
   }
   var TABLESS = /* @__PURE__ */ new Set(["tabs_list", "tab_new", "ping_probe", "download_file", "proxy_status"]);
   async function resolveTab(cmd) {
+    if (cmd.method === "download_file" && typeof cmd.params.url !== "string") return targetTab(cmd);
     if (TABLESS.has(cmd.method)) return null;
     return targetTab(cmd);
   }
@@ -1233,8 +1700,9 @@
     const w = cmd.params.waitUntil;
     return w === "domcontentloaded" || w === "networkidle" ? w : "load";
   }
-  function armNavigationWait(tabId, waitUntil, timeoutMs = 3e4) {
+  function armNavigationWait(tabId, waitUntil, timeoutMs = 3e4, expectedUrl) {
     const start = Date.now();
+    const destination = expectedUrl === void 0 ? void 0 : new URL(expectedUrl).href;
     const NETWORK_QUIET_MS = 500;
     let done = () => void 0;
     const finished = new Promise((resolve) => {
@@ -1250,21 +1718,26 @@
     };
     const onBefore = (d) => {
       if (!isTop(d)) return;
+      if (destination && !started && d.url !== destination) return;
       started = true;
       startUrl = d.url;
       committed = false;
     };
     const onCommitted = (d) => {
-      if (isTop(d)) committed = true;
+      if (!isTop(d)) return;
+      const redirected = d.transitionQualifiers.some((q) => q === "server_redirect" || q === "client_redirect");
+      if (destination && (!started || d.url !== startUrl && !redirected)) return;
+      startUrl = d.url;
+      committed = true;
     };
     const onDom = (d) => {
-      if (isTop(d) && committed && waitUntil === "domcontentloaded") done();
+      if (isTop(d) && committed && (!destination || d.url === startUrl) && waitUntil === "domcontentloaded") done();
     };
     const onCompleted = (d) => {
-      if (isTop(d) && committed) reached();
+      if (isTop(d) && committed && (!destination || d.url === startUrl)) reached();
     };
     const onSameDoc = (d) => {
-      if (isTop(d)) done();
+      if (isTop(d) && (!destination || d.url === destination)) done();
     };
     const onError = (d) => {
       if (!isTop(d) || !started) return;
@@ -1397,6 +1870,7 @@
     return locks.run(`dbg:${tabId}`, async () => {
       const target = { tabId };
       const once = async () => {
+        await requireSitePermission((await chrome.tabs.get(tabId)).url ?? "");
         await ensureAttached(tabId);
         return fn(target);
       };
@@ -1458,7 +1932,7 @@
     const found = await execOp(tabId, { op: "measure", selector: selector ?? null }, frameIds);
     const top = selector && frameIds && frameIds.length > 0 ? await execOp(tabId, { op: "measure", selector: null }) : found;
     return {
-      dims: top.dims,
+      dims: { ...top.dims, zoom: await chrome.tabs.getZoom(tabId) },
       element: found.element ?? null,
       missing: found.missing === true
     };
@@ -1504,6 +1978,43 @@
       fullHeight: plan.fullHeight
     };
   }
+  var SETTLE_MS = 5e3;
+  var SETTLE_QUIET_MS = 400;
+  async function waitForSettled(tabId, quietMs = 0) {
+    const deadline = Date.now() + SETTLE_MS;
+    let last = "";
+    let since = Date.now();
+    while (Date.now() < deadline) {
+      const t = await chrome.tabs.get(tabId).catch(() => null);
+      if (!t) return;
+      const state = `${t.status}|${t.url}`;
+      if (state !== last) {
+        last = state;
+        since = Date.now();
+      }
+      if (t.status === "complete" && Date.now() - since >= quietMs) return;
+      await delay(100);
+    }
+  }
+  async function pageMoved(tabId, url) {
+    const t = await chrome.tabs.get(tabId).catch(() => null);
+    return !!t && (t.status === "loading" || t.url !== url);
+  }
+  async function scaleShot(dataUrl, width, height, enc) {
+    const raw = dataUrl.split(",")[1] ?? "";
+    if (!(width > 0 && height > 0)) return raw;
+    const bitmap = await createImageBitmap(await (await fetch(dataUrl)).blob());
+    if (Math.abs(bitmap.width - width) <= 1) return raw;
+    const canvas = new OffscreenCanvas(width, height);
+    canvas.getContext("2d")?.drawImage(bitmap, 0, 0, width, height);
+    const blob = await canvas.convertToBlob(
+      enc.format === "jpeg" ? { type: "image/jpeg", quality: enc.quality / 100 } : { type: "image/png" }
+    );
+    const bytes = new Uint8Array(await blob.arrayBuffer());
+    let bin = "";
+    for (let i = 0; i < bytes.length; i += 32768) bin += String.fromCharCode(...bytes.subarray(i, i + 32768));
+    return btoa(bin);
+  }
   async function screenshotViaVisibleTab(tabId, fullPage, enc) {
     let t = await chrome.tabs.get(tabId);
     let restore;
@@ -1532,8 +2043,11 @@
     );
     const viewportH = dims?.h ?? 0;
     const fullH = dims?.full ?? viewportH;
+    const scale = enc.scale ?? DEFAULT_SCREENSHOT_SCALE;
+    const out = Math.round((dims?.w ?? 0) * scale);
+    const outH = Math.round(viewportH * scale);
     return {
-      dataBase64: dataUrl.split(",")[1] ?? "",
+      dataBase64: await scaleShot(dataUrl, out, outH, enc).catch(() => dataUrl.split(",")[1] ?? ""),
       mimeType: enc.format === "jpeg" ? "image/jpeg" : "image/png",
       width: dims?.w ?? 0,
       height: viewportH,
@@ -1591,10 +2105,12 @@
      * allowlisted page embedding a third-party iframe is the ordinary case, not an
      * exotic one.
      */
-    constructor(getPolicy = () => null) {
+    constructor(getPolicy = () => null, onBlocked) {
       this.getPolicy = getPolicy;
+      this.onBlocked = onBlocked;
     }
     getPolicy;
+    onBlocked;
     /** The absolute URL a link (or img/source) element points at, for a download
      *  by element. Gated like a download by URL: the router only checked the tab
      *  the link sits in, and the link can lead to any site. */
@@ -1619,7 +2135,7 @@
         frameIds
       );
       if (!url) throw new CmdError("DOWNLOAD_FAILED", `the element ${sel} has no href or src to download`);
-      this.assertAllowed(url, "download_file");
+      await this.assertAllowed(url, "download_file");
       return url;
     }
     allowed(url, method) {
@@ -1627,10 +2143,21 @@
       return !!policy && evaluatePolicy(url, method, policy).ok;
     }
     /** Gate a URL the router could not see (it gates the tab, not arguments). */
-    assertAllowed(url, method) {
+    async assertAllowed(url, method) {
       const policy = this.getPolicy();
       const verdict = policy ? evaluatePolicy(url, method, policy) : { ok: false, reason: "no policy has arrived yet" };
-      if (!verdict.ok) throw new CmdError("POLICY_DENIED", verdict.reason);
+      if (!verdict.ok) {
+        const host = hostOf(url);
+        if (policy && host && !isDomainAllowed(url, policy)) this.onBlocked?.(host, method);
+        throw new CmdError("POLICY_DENIED", verdict.reason);
+      }
+      try {
+        await requireSitePermission(url);
+      } catch (err) {
+        const host = hostOf(url);
+        if (host) this.onBlocked?.(host, method);
+        throw err;
+      }
     }
     /**
      * Resolve `frameId` / `allFrames` params into the frame ids an injection may
@@ -1664,15 +2191,15 @@
       const policy = this.getPolicy();
       if (!policy) throw new CmdError("POLICY_DENIED", "no policy has arrived yet, so no frame is authorized");
       const allowed = [];
-      const denied = [];
+      const denied2 = [];
       for (const f of seen) {
         if (evaluatePolicy(f.url, cmd.method, policy).ok) allowed.push(f.frameId);
-        else denied.push(f.url || `frame ${f.frameId}`);
+        else denied2.push(f.url || `frame ${f.frameId}`);
       }
       if (allowed.length === 0) {
         throw new CmdError(
           "POLICY_DENIED",
-          `no targeted frame is on the allowed-sites list (skipped: ${denied.slice(0, 5).join(", ")})`
+          `no targeted frame is on the allowed-sites list (skipped: ${denied2.slice(0, 5).join(", ")})`
         );
       }
       return allowed;
@@ -1700,7 +2227,7 @@
         }
         case "tab_new": {
           const url = typeof cmd.params.url === "string" ? cmd.params.url : void 0;
-          if (url !== void 0) this.assertAllowed(url, "navigate");
+          if (url !== void 0) await this.assertAllowed(url, "navigate");
           const active = cmd.params.active !== false;
           const BLANK = /^(about:blank|chrome:\/\/newtab|chrome:\/\/new-tab-page|edge:\/\/newtab)/i;
           const claim = await locks.run("tab_new", async () => {
@@ -1722,7 +2249,7 @@
             return { id: created.id, reused: false, needsNav: url !== void 0 };
           });
           if (claim.needsNav) {
-            const nav = armNavigationWait(claim.id, "load", 25e3);
+            const nav = armNavigationWait(claim.id, "load", 25e3, url);
             await chrome.tabs.update(claim.id, { url }).catch((err) => {
               nav.cancel();
               throw err;
@@ -1745,7 +2272,7 @@
         case "navigate": {
           const id = await targetTab2(cmd);
           const url = String(cmd.params.url);
-          const nav = armNavigationWait(id, waitUntilOf(cmd));
+          const nav = armNavigationWait(id, waitUntilOf(cmd), 3e4, url);
           await chrome.tabs.update(id, { url }).catch((err) => {
             nav.cancel();
             throw err;
@@ -1843,7 +2370,8 @@
           const t = await chrome.tabs.get(id);
           const url = typeof cmd.params.url === "string" ? cmd.params.url : t.url;
           if (!url) throw new CmdError("BAD_ARGS", "no url to read cookies for");
-          if (url !== t.url) this.assertAllowed(url, "get_cookies");
+          if (url !== t.url) await this.assertAllowed(url, "get_cookies");
+          await requireFeaturePermission("cookies");
           const cookies = await chrome.cookies.getAll({ url });
           return {
             cookies: cookies.map((c) => ({
@@ -2062,9 +2590,24 @@
           if (selector && !await waitForSelector(id, selector, frameIds, READ_WAIT_MS)) {
             throw notFound(selector, await execOp(id, { op: "waitSelector", selector, timeoutMs: 0 }, frameIds));
           }
-          try {
+          await waitForSettled(id);
+          const shoot = async () => {
+            const at = (await chrome.tabs.get(id)).url;
+            if (at) await this.assertAllowed(at, "screenshot");
+            const shot = await screenshotViaDebugger(id, fullPage, enc, selector, frameIds).catch(async (err) => {
+              if (!await pageMoved(id, at)) throw err;
+              return null;
+            });
+            if (shot && !await pageMoved(id, at)) return shot;
+            await waitForSettled(id, SETTLE_QUIET_MS);
+            const now = (await chrome.tabs.get(id)).url;
+            if (now) await this.assertAllowed(now, "screenshot");
             return await screenshotViaDebugger(id, fullPage, enc, selector, frameIds);
+          };
+          try {
+            return await shoot();
           } catch (err) {
+            if (err instanceof CmdError && err.code === "POLICY_DENIED") throw err;
             if (err instanceof CmdError && (err.code === "SELECTOR_NOT_FOUND" || err.code === "TIMEOUT")) throw err;
             return await screenshotViaVisibleTab(id, fullPage, enc);
           }
@@ -2117,10 +2660,74 @@
         //    the absolute on-disk path so the server can relocate it. --
         case "download_file": {
           const url = typeof cmd.params.url === "string" ? cmd.params.url : await this.linkTarget(cmd);
+          await this.assertAllowed(url, "download_file");
+          await requireFeaturePermission("downloads");
           const name = sanitizeDownloadName(
             typeof cmd.params.suggestedName === "string" ? cmd.params.suggestedName : void 0
           );
-          const downloadId = await chrome.downloads.download({ url, filename: name });
+          let response;
+          try {
+            response = await fetch(url, { credentials: "omit", redirect: "error", signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) });
+          } catch {
+            throw new CmdError("DOWNLOAD_FAILED", "download request failed or its redirect was not permitted");
+          }
+          if (!response.url) {
+            await response.body?.cancel().catch(() => void 0);
+            throw new CmdError("DOWNLOAD_FAILED", "download did not resolve to a valid address");
+          }
+          try {
+            await this.assertAllowed(response.url, "download_file");
+          } catch (err) {
+            await response.body?.cancel().catch(() => void 0);
+            throw err;
+          }
+          if (!response.ok) {
+            await response.body?.cancel().catch(() => void 0);
+            throw new CmdError("DOWNLOAD_FAILED", `download returned HTTP ${response.status}`);
+          }
+          const declaredLength = Number(response.headers.get("content-length"));
+          if (Number.isFinite(declaredLength) && declaredLength > MAX_DOWNLOAD_BYTES2) {
+            await response.body?.cancel().catch(() => void 0);
+            throw new CmdError("DOWNLOAD_FAILED", "download exceeds the 50 MiB extension limit");
+          }
+          const chunks = [];
+          let totalBytes = 0;
+          const reader = response.body?.getReader();
+          if (reader) {
+            try {
+              while (true) {
+                const { done, value } = await reader.read();
+                if (done) break;
+                totalBytes += value.byteLength;
+                if (totalBytes > MAX_DOWNLOAD_BYTES2) {
+                  await reader.cancel();
+                  throw new CmdError("DOWNLOAD_FAILED", "download exceeds the 50 MiB extension limit");
+                }
+                chunks.push(value);
+              }
+            } catch (err) {
+              await reader.cancel().catch(() => void 0);
+              throw err;
+            }
+          }
+          const bytesView = new Uint8Array(totalBytes);
+          let copied = 0;
+          for (const chunk of chunks) {
+            bytesView.set(chunk, copied);
+            copied += chunk.byteLength;
+          }
+          const encoded = [];
+          const base64ChunkBytes = 24576;
+          for (let offset = 0; offset < bytesView.length; offset += base64ChunkBytes) {
+            const end = Math.min(bytesView.length, offset + base64ChunkBytes);
+            let binary = "";
+            for (let i = offset; i < end; i += 16384) {
+              binary += String.fromCharCode(...bytesView.subarray(i, Math.min(end, i + 16384)));
+            }
+            encoded.push(btoa(binary));
+          }
+          const dataUrl = `data:application/octet-stream;base64,${encoded.join("")}`;
+          const downloadId = await chrome.downloads.download({ url: dataUrl, filename: name, saveAs: false });
           const item = await waitForDownloadComplete(downloadId);
           const bytes = item.fileSize > 0 ? item.fileSize : item.bytesReceived;
           return {
@@ -2287,8 +2894,25 @@
       }
     }
     deps;
-    async dispatch(cmd) {
+    async dispatch(cmd, send = this.deps.send) {
+      const record = this.deps.activity?.();
+      const entry = cmd.method === "ping_probe" ? null : {
+        id: crypto.randomUUID(),
+        at: Date.now(),
+        method: cmd.method,
+        host: "",
+        app: "",
+        key: "",
+        outcome: "running"
+      };
+      let ran = false;
+      let checkStopped;
       try {
+        checkStopped = this.deps.access?.();
+        if (isHealthProbe(cmd)) {
+          send({ type: "result", v: PROTOCOL_VERSION, id: cmd.id, ok: true, data: { ok: true } });
+          return;
+        }
         const policy = this.deps.getPolicy();
         if (!policy && cmd.method !== "ping_probe") {
           throw new CmdError(
@@ -2296,25 +2920,101 @@
             "no policy has arrived from the MCP Browser Extension server yet, so this extension is refusing every command"
           );
         }
+        if (!this.deps.authorize) throw new CmdError("POLICY_DENIED", "Client approval enforcement is unavailable.");
+        const checkApproval = await this.deps.authorize(cmd, (id, name) => {
+          if (entry) {
+            entry.key = id;
+            entry.app = name;
+          }
+        });
+        const checkAccess = () => {
+          checkStopped?.();
+          checkApproval();
+        };
+        if (cmd.method === "ping_probe") {
+          checkAccess();
+          send({ type: "result", v: PROTOCOL_VERSION, id: cmd.id, ok: true, data: {} });
+          return;
+        }
         const tab = await resolveTab(cmd);
+        if (entry && tab !== null) entry.tabId = tab;
+        if (entry && cmd.method === "tab_new") entry.host = activityHost(
+          typeof cmd.params.url === "string" ? cmd.params.url : "chrome://newtab"
+        );
+        if (cmd.method === "tab_new" && typeof cmd.params.url === "string" && cmd.params.url !== "about:blank") {
+          const url = cmd.params.url;
+          if (entry) entry.host = activityHost(url);
+          if (isOwnExtensionPage(url)) throw new CmdError("POLICY_DENIED", "MCP Browser Extension never acts on its own pages");
+          const verdict = evaluatePolicy(url, "navigate", policy);
+          if (!verdict.ok) {
+            this.deps.onBlocked?.(hostOf(url), cmd.method);
+            throw new CmdError("POLICY_DENIED", verdict.reason);
+          }
+          try {
+            await requireSitePermission(url);
+          } catch (err) {
+            this.deps.onBlocked?.(hostOf(url), cmd.method);
+            throw err;
+          }
+        }
+        const targetUrl = tab !== null ? await observedTabUrl(cmd, tab) : "";
+        if (tab !== null && isOwnExtensionPage(targetUrl)) {
+          throw new CmdError("POLICY_DENIED", "MCP Browser Extension never acts on its own pages");
+        }
+        if (entry && tab !== null && !isUrlGated(cmd.method)) entry.host = activityHost(targetUrl);
         if (policy) {
           const url = isUrlGated(cmd.method) ? await urlForCommand(cmd, tab) : "";
+          if (entry && url) entry.host = activityHost(url);
           if (url && isOwnExtensionPage(url)) {
             throw new CmdError("POLICY_DENIED", "MCP Browser Extension never acts on its own pages");
           }
           const verdict = evaluatePolicy(url, cmd.method, policy);
-          if (!verdict.ok) throw new CmdError("POLICY_DENIED", verdict.reason);
+          if (!verdict.ok) {
+            const host = hostOf(url);
+            if (host && isUrlGated(cmd.method) && !isDomainAllowed(url, policy)) this.deps.onBlocked?.(host, cmd.method);
+            throw new CmdError("POLICY_DENIED", verdict.reason);
+          }
+          if (isUrlGated(cmd.method) && url !== "about:blank") {
+            try {
+              await requireSitePermission(url);
+            } catch (err) {
+              const host = hostOf(url);
+              if (host) this.deps.onBlocked?.(host, cmd.method);
+              throw err;
+            }
+          }
         }
+        checkAccess();
+        const run = () => {
+          checkAccess();
+          ran = true;
+          if (entry) record?.({ ...entry });
+          return this.deps.exec.run(cmd, tab);
+        };
         const border2 = this.deps.border;
-        const data = border2 && CAPTURES.has(cmd.method) ? await border2.aroundCapture(tab, () => this.deps.exec.run(cmd, tab)) : await this.deps.exec.run(cmd, tab);
+        const data = border2 && CAPTURES.has(cmd.method) ? await border2.aroundCapture(tab, run) : await run();
+        checkAccess();
+        if (entry && cmd.method === "tab_new") {
+          const opened = data;
+          const id = Number(opened?.tabId?.split(":")[2]);
+          if (Number.isSafeInteger(id) && id >= 0) entry.tabId = id;
+          if (opened?.url) entry.host = activityHost(opened.url) || entry.host;
+        }
         if (border2) void this.markBorder(border2, cmd, tab, data);
         const frame = { type: "result", v: PROTOCOL_VERSION, id: cmd.id, ok: true, data };
         const tabUrl = await observedTabUrl(cmd, tab);
+        checkAccess();
         if (tabUrl) frame.tabUrl = tabUrl;
-        this.deps.send(frame);
+        if (entry) {
+          if (!entry.host && tab !== null && tabUrl) entry.host = activityHost(tabUrl);
+          const result = data;
+          entry.outcome = cmd.method === "fill_form" && result?.error || cmd.method === "eval" && result?.ok === false ? "failed" : "done";
+        }
+        send(frame);
       } catch (err) {
         const code = err instanceof CmdError ? err.code : "CDP_ERROR";
         const message = err instanceof Error ? err.message : String(err);
+        if (entry) entry.outcome = ran && code === "POLICY_DENIED" ? "interrupted" : code === "POLICY_DENIED" ? "blocked" : "failed";
         this.deps.log(`command "${cmd.method}" failed: ${message}`);
         const frame = {
           type: "error",
@@ -2323,7 +3023,9 @@
           ok: false,
           error: { code, message }
         };
-        this.deps.send(frame);
+        send(frame);
+      } finally {
+        if (entry) record?.(entry);
       }
     }
     /** Border the tab a successful command worked in. Never delays or fails the reply. */
@@ -2343,10 +3045,18 @@
 
   // extension/src/sw/observers.ts
   var SCRIPT_ID = "chrome-mcp-observers";
-  async function syncObserverScript(policy, log) {
+  var updates = Promise.resolve();
+  function syncObserverScript(policy, log) {
+    updates = updates.then(() => applyObserverScript(policy, log));
+    return updates;
+  }
+  async function applyObserverScript(policy, log) {
     try {
+      await initializeBrowserPermissions();
       const existing = await chrome.scripting.getRegisteredContentScripts({ ids: [SCRIPT_ID] }).catch(() => []);
-      const wanted = policy ? observerMatches(policy) : [];
+      const candidates = (policy ? observerMatches(policy) : []).flatMap((pattern) => pattern.startsWith("*://") ? [`http${pattern.slice(1)}`, `https${pattern.slice(1)}`] : [pattern]);
+      const checks = await Promise.all(candidates.map(async (pattern) => await chrome.permissions.contains({ origins: [pattern] }) ? pattern : null));
+      const wanted = checks.filter((pattern) => pattern !== null);
       if (wanted.length === 0) {
         if (existing.length > 0) {
           await chrome.scripting.unregisterContentScripts({ ids: [SCRIPT_ID] });
@@ -2536,7 +3246,7 @@
           delete marked[tabId];
         } else {
           await unpaint(tabId, marked[tabId]);
-          marked[tabId] = await paint(tabId);
+          marked[tabId] = this.capturing.has(tabId) ? "" : await paint(tabId);
         }
         await saveMarked(marked);
       });
@@ -2554,11 +3264,10 @@
       if (tabId === null) return fn();
       const css = await this.locked(async () => {
         const c = (await loadMarked())[tabId] ?? "";
-        if (c) this.capturing.set(tabId, (this.capturing.get(tabId) ?? 0) + 1);
+        this.capturing.set(tabId, (this.capturing.get(tabId) ?? 0) + 1);
         await unpaint(tabId, c);
         return c;
       });
-      if (!css) return fn();
       try {
         return await fn();
       } finally {
@@ -2566,7 +3275,7 @@
           const left = (this.capturing.get(tabId) ?? 1) - 1;
           if (left > 0) return void this.capturing.set(tabId, left);
           this.capturing.delete(tabId);
-          if ((await loadMarked())[tabId] !== css) return;
+          if (!css || (await loadMarked())[tabId] !== css) return;
           await bounded(chrome.scripting.insertCSS({ target: { tabId }, css, origin: "USER" }), void 0);
         });
       }
@@ -2581,6 +3290,15 @@
     }
   };
 
+  // extension/src/site-access.ts
+  async function permittedSites(sites) {
+    const checks = await Promise.all(sites.map(async (site) => {
+      const origins = siteOrigins(site);
+      return origins.length && await chrome.permissions.contains({ origins }).catch(() => false) ? site : null;
+    }));
+    return checks.filter((site) => site !== null);
+  }
+
   // extension/src/connect.ts
   var NATIVE_HOST = "com.mehmoodqureshi.mcp_browser_extension";
   async function fetchPairing() {
@@ -2608,18 +3326,33 @@
       pairingSource: "native"
     });
   }
+  async function requestPairingFromClick() {
+    let granted = false;
+    try {
+      granted = await chrome.permissions.request({ permissions: ["nativeMessaging"] });
+    } catch (err) {
+      return { ok: false, message: err instanceof Error ? err.message : String(err) };
+    }
+    if (!granted) return { ok: false, message: "Chrome needs that permission to fetch the pairing for you. You can also pair by hand in Settings." };
+    return fetchPairing();
+  }
 
   // extension/src/sw/background.ts
+  var pendingClients = 0;
+  var pendingFeatures = 0;
   var KEEPALIVE_ALARM = "chrome-mcp-keepalive";
   var MAX_BLOCKED = 10;
   var currentPolicy = null;
-  var executor = new ChromeExecutor(() => currentPolicy);
+  var reportBlocked = (host, method) => {
+    void rememberBlocked(host, method).catch(() => void 0);
+  };
+  var executor = new ChromeExecutor(() => currentPolicy, reportBlocked);
   var border = new TabBorder(() => currentPolicy);
   var RECONNECT_DELAYS_MS = [1e3, 2e3, 4e3, 8e3, 1e4];
   var reconnectAttempt = 0;
   var reconnectTimer = null;
   function scheduleReconnect() {
-    if (reconnectTimer) return;
+    if (access.stopped || reconnectTimer) return;
     const delay2 = RECONNECT_DELAYS_MS[Math.min(reconnectAttempt, RECONNECT_DELAYS_MS.length - 1)];
     reconnectAttempt++;
     reconnectTimer = setTimeout(() => {
@@ -2633,7 +3366,7 @@
     reconnectAttempt = 0;
   }
   var ws = new WsClient({
-    onCommand: (cmd) => void router.dispatch(cmd),
+    onCommand: (cmd, reply) => void router.dispatch(cmd, reply),
     onState: (state) => {
       void persistState(state);
       if (state === "connected") clearReconnect();
@@ -2642,6 +3375,14 @@
       if (state === "unauthorized") void adoptBundledPairing().then((took) => took ? true : healFromHelper());
     },
     onPolicy: (policy) => {
+      if (access.stopped) return;
+      if (!policy || !Array.isArray(policy.allowDomains) || policy.allowDomains.some((site) => typeof site !== "string")) {
+        currentPolicy = null;
+        void syncObserverScript(null, (m) => console.debug("[mcp-browser-extension]", m));
+        void chrome.storage.local.set({ allowedSites: [] });
+        return;
+      }
+      policy = { ...policy, allowDomains: policy.allowDomains.map(normalizeDomainPattern).filter(Boolean) };
       currentPolicy = policy;
       void syncObserverScript(policy, (m) => console.debug("[mcp-browser-extension]", m));
       void onAllowlist(policy);
@@ -2653,10 +3394,59 @@
     onLatestExtension: (version) => void chrome.storage.local.set({ latestExtension: version }),
     log: (m) => console.debug("[mcp-browser-extension]", m)
   });
+  var approvals = new ClientApprovals({
+    read: async () => (await chrome.storage.local.get(CLIENT_STORAGE_KEY))[CLIENT_STORAGE_KEY],
+    write: async (clients) => {
+      await chrome.storage.local.set({ [CLIENT_STORAGE_KEY]: clients });
+    },
+    challenge: () => ws.approvalChallenge,
+    changed: (clients) => {
+      pendingClients = clients.filter((c) => c.state === "pending" && c.expiresAt > Date.now()).length;
+      reflectBadge(ws.state);
+    }
+  });
+  var activity = new ActivityLog({
+    read: async () => (await chrome.storage.session.get(ACTIVITY_KEY))[ACTIVITY_KEY],
+    write: async (entries) => {
+      await chrome.storage.session.set({ [ACTIVITY_KEY]: entries });
+    }
+  });
+  var historyHasFailed = false;
+  var historyFailed = () => {
+    if (historyHasFailed) return;
+    historyHasFailed = true;
+    void chrome.storage.session.set({ activityError: true }).catch(() => void 0);
+  };
+  var access = new AccessSwitch({
+    read: async () => (await chrome.storage.local.get(ACCESS_STOPPED_KEY))[ACCESS_STOPPED_KEY],
+    write: async (stopped) => {
+      await chrome.storage.local.set({ [ACCESS_STOPPED_KEY]: stopped });
+    },
+    revoke: () => approvals.revokeAll(),
+    disconnect: () => {
+      clearReconnect();
+      ws.close();
+      ws.state = "idle";
+      currentPolicy = null;
+      void persistState("idle");
+      void border.clearAll();
+      void syncObserverScript(null, (m) => console.debug("[mcp-browser-extension]", m));
+      void activity.interrupt().catch(historyFailed);
+    }
+  });
   var router = new CommandRouter({
+    authorize: (cmd, verified) => approvals.authorize(cmd, verified),
+    access: () => access.check(),
+    activity: () => {
+      const generation = activity.token();
+      return (entry) => {
+        void activity.record(entry, generation).catch(historyFailed);
+      };
+    },
     exec: executor,
     send: (frame) => ws.send(frame),
     getPolicy: () => currentPolicy,
+    onBlocked: reportBlocked,
     log: (m) => console.debug("[mcp-browser-extension]", m),
     border
   });
@@ -2716,19 +3506,24 @@
     return null;
   }
   async function onAllowlist(policy) {
+    await initializeBrowserPermissions();
+    const effective = { ...policy, allowDomains: await permittedSites(policy.allowDomains) };
     const { blockedSites } = await chrome.storage.local.get("blockedSites");
     const still = (Array.isArray(blockedSites) ? blockedSites : []).filter(
-      (b) => !isDomainAllowed(`https://${b.host}/`, policy)
+      (b) => !isDomainAllowed(`https://${b.host}/`, effective)
     );
     await chrome.storage.local.set({ allowedSites: policy.allowDomains, blockedSites: still });
     pendingBlocked = still.length;
     reflectBadge(ws.state);
   }
   async function rememberBlocked(host, method) {
-    const { blockedSites } = await chrome.storage.local.get("blockedSites");
+    const { blockedSites, dismissedSites } = await chrome.storage.local.get(["blockedSites", "dismissedSites"]);
     const prior = (Array.isArray(blockedSites) ? blockedSites : []).filter((b) => b.host !== host);
     const next = [{ host, method, at: Date.now() }, ...prior].slice(0, MAX_BLOCKED);
-    await chrome.storage.local.set({ blockedSites: next });
+    await chrome.storage.local.set({
+      blockedSites: next,
+      dismissedSites: (Array.isArray(dismissedSites) ? dismissedSites : []).filter((site) => site !== host)
+    });
     pendingBlocked = next.length;
     reflectBadge(ws.state);
   }
@@ -2753,7 +3548,7 @@
     }
   };
   function reflectBadge(state) {
-    const b = state === "connected" && pendingBlocked > 0 ? BLOCKED_BADGE : BADGE[state] ?? BADGE.idle;
+    const b = access.stopped ? { text: "OFF", color: "#b91c1c", title: "MCP Browser Extension \u2014 access stopped" } : pendingClients > 0 ? { text: "?", color: "#b45309", title: "App connection awaiting approval. Open Settings to review." } : state === "connected" && pendingBlocked > 0 ? BLOCKED_BADGE : pendingFeatures > 0 ? { text: "?", color: "#b45309", title: "Permission needed. Open the extension popup \u2192 Extra permissions." } : BADGE[state] ?? BADGE.idle;
     try {
       void chrome.action.setBadgeText({ text: b.text });
       void chrome.action.setBadgeBackgroundColor({ color: b.color });
@@ -2773,10 +3568,21 @@
     }
   }
   async function ensureConnected() {
+    try {
+      await access.initialize();
+    } catch {
+      reflectBadge("idle");
+      return;
+    }
+    if (access.stopped) {
+      reflectBadge("idle");
+      return;
+    }
     if (ws.isConnected() || ws.state === "unauthorized" || ws.state === "superseded") return;
     const cfg = await getConfig();
     if (!cfg) return;
-    ws.connect(cfg.wsPort, cfg.token, cfg.profile, cfg.installId, await installType());
+    const install = await installType();
+    if (!access.stopped) ws.connect(cfg.wsPort, cfg.token, cfg.profile, cfg.installId, install);
   }
   async function keepalivePulse() {
     await chrome.storage.local.get("connState");
@@ -2796,10 +3602,45 @@
     if (info.status === "complete") void border.loaded(tabId);
   });
   chrome.tabs.onRemoved.addListener((tabId) => void border.closed(tabId));
-  chrome.webRequest.onAuthRequired.addListener(onProxyAuth, { urls: ["<all_urls>"] }, [
-    "asyncBlocking"
-  ]);
+  function syncProxyAuthListener() {
+    const event = chrome.webRequest?.onAuthRequired;
+    if (!event) return;
+    void chrome.permissions.contains({ permissions: ["webRequest", "webRequestAuthProvider"] }).then((granted) => {
+      if (event.hasListener(onProxyAuth)) event.removeListener(onProxyAuth);
+      if (granted) event.addListener(onProxyAuth, { urls: ["http://*/*", "https://*/*"] }, ["asyncBlocking"]);
+    });
+  }
+  syncProxyAuthListener();
+  async function permissionsChanged() {
+    syncProxyAuthListener();
+    await refreshFeatureBadge();
+    if (currentPolicy) {
+      await onAllowlist(currentPolicy);
+      await syncObserverScript(currentPolicy, (m) => console.debug("[mcp-browser-extension]", m));
+    }
+    await border.clearAll();
+  }
+  var featureBadgeGeneration = 0;
+  async function refreshFeatureBadge() {
+    const generation = ++featureBadgeGeneration;
+    const saved = (await chrome.storage.local.get(FEATURE_REQUESTS_KEY))[FEATURE_REQUESTS_KEY];
+    const requested = Array.isArray(saved) ? saved.filter((p) => typeof p === "string" && p in OPTIONAL_FEATURES) : [];
+    const missing = await Promise.all(requested.map(async (permission) => !await chrome.permissions.contains({ permissions: [permission] })));
+    if (generation !== featureBadgeGeneration) return;
+    pendingFeatures = missing.filter(Boolean).length;
+    reflectBadge(ws.state);
+  }
+  chrome.permissions.onAdded.addListener((permissions) => {
+    void (async () => {
+      if (permissions.origins?.some(isGlobalOrigin)) await removeGlobalOrigins();
+      await permissionsChanged();
+    })().catch((err) => console.warn("[mcp-browser-extension] permission change failed", err));
+  });
+  chrome.permissions.onRemoved.addListener(() => {
+    void permissionsChanged().catch((err) => console.warn("[mcp-browser-extension] permission change failed", err));
+  });
   chrome.storage.onChanged.addListener((changes, area) => {
+    if (area === "local" && changes[FEATURE_REQUESTS_KEY]) void refreshFeatureBadge();
     if (area === "local" && changes.tabBorder?.newValue === false) void border.clearAll();
     if (area === "local" && changes[PROXY_STORAGE_KEY]) void syncProxy();
     if (area === "local" && (changes.wsPort || changes.token || changes.profile)) {
@@ -2810,21 +3651,118 @@
     }
   });
   chrome.runtime.onMessage.addListener((msg, sender, reply) => {
+    if (msg?.type === "connect_with_click") {
+      if (!isApprovalPage(sender) || access.stopped) {
+        reply({ ok: false, message: "Use Resume connection in the extension popup or Settings first." });
+        return;
+      }
+      void requestPairingFromClick().then(async (result) => {
+        if (!result.ok) {
+          reply(result);
+          return;
+        }
+        if (access.stopped) {
+          reply({ ok: false, message: "Access is stopped. Use Resume connection first." });
+          return;
+        }
+        await applyPairing(result);
+        clearReconnect();
+        ws.close();
+        ws.state = "idle";
+        await ensureConnected();
+        reply({ ok: true });
+      }).catch(() => reply({ ok: false, message: "Could not connect. Please try again." }));
+      return true;
+    }
+    if (msg?.type === "feature_access") {
+      if (!isApprovalPage(sender) || !Object.hasOwn(OPTIONAL_FEATURES, msg.feature) || typeof msg.allow !== "boolean") {
+        reply({ ok: false, error: "Use Extra permissions in the extension popup or Settings." });
+        return;
+      }
+      const operation = msg.allow ? chrome.permissions.request({ permissions: [msg.feature] }) : chrome.permissions.remove({ permissions: [msg.feature] });
+      void operation.then((changed) => reply({
+        ok: changed || !msg.allow,
+        ...!changed && msg.allow ? { error: "No access was added. You can allow it whenever you are ready." } : {}
+      }), () => reply({ ok: false, error: "Could not change this permission. Please try again." }));
+      return true;
+    }
+    if (["access_stop", "access_resume", "activity_clear"].includes(msg?.type)) {
+      if (!isApprovalPage(sender)) {
+        reply({ ok: false, error: "Use the extension popup or Settings to change browser access or history." });
+        return;
+      }
+      const operation = msg.type === "access_stop" ? access.stop() : msg.type === "access_resume" ? access.resume().then(() => ensureConnected()) : activity.clear().then(async () => {
+        await chrome.storage.session.set({ activityError: false });
+        historyHasFailed = false;
+      });
+      void operation.then(() => {
+        reflectBadge(ws.state);
+        reply({ ok: true });
+      }, () => reply({ ok: false, error: msg.type === "activity_clear" ? "Could not clear history. Please try again." : "Access is blocked in this session, but the setting could not be saved. Try Stop access again before restarting Chrome." }));
+      return true;
+    }
+    if (msg?.type === "client_decision") {
+      if (!isApprovalPage(sender) || typeof msg.id !== "string" || typeof msg.allow !== "boolean") {
+        reply({ ok: false, error: "Client approval requires the extension popup or Settings page." });
+        return;
+      }
+      if (msg.allow && access.stopped) {
+        reply({ ok: false, error: "Access is stopped. Use Resume connection first, then approve the app." });
+        return;
+      }
+      void approvals.decide(msg.id, msg.allow).then(
+        () => reply({ ok: true }),
+        (err) => reply({ ok: false, error: err instanceof Error ? err.message : "Could not save the decision." })
+      );
+      return true;
+    }
     if (msg?.type === "reconnect") {
+      if (!isApprovalPage(sender)) return;
+      if (access.stopped) {
+        reply({ ok: false, error: "Access is stopped. Use Resume connection in the extension popup or Settings." });
+        return;
+      }
       clearReconnect();
       ws.close();
       ws.state = "idle";
       void ensureConnected();
     }
-    if (msg?.type === "site_grant" && typeof msg.host === "string") {
-      if (sender.id !== chrome.runtime.id || !sender.url?.startsWith(chrome.runtime.getURL(""))) return;
+    if (["site_grant", "site_access"].includes(msg?.type) && typeof msg.host === "string") {
+      if (!isApprovalPage(sender) || typeof msg.allow !== "boolean") {
+        reply({ ok: false, error: "Please approve this website in the extension popup or Settings." });
+        return;
+      }
       if (!ws.isConnected()) {
         reply({ ok: false, error: "not connected to the MCP Browser Extension server" });
         return;
       }
-      const frame = { type: "site_grant", v: PROTOCOL_VERSION, host: msg.host, allow: msg.allow !== false };
-      ws.send(frame);
-      reply({ ok: true });
+      const origins = siteOrigins(msg.host);
+      if (!origins.length) {
+        reply({ ok: false, error: "Please enter one website. All-site access is not available." });
+        return;
+      }
+      const permission = msg.type === "site_access" && msg.allow ? chrome.permissions.request({ origins }) : Promise.resolve(true);
+      void (async () => {
+        if (!await permission) {
+          reply({ ok: false, error: "No access was added. You can click Allow whenever you are ready." });
+          return;
+        }
+        await initializeBrowserPermissions();
+        if (!origins.length || msg.allow && !await chrome.permissions.contains({ origins })) {
+          reply({ ok: false, error: "Please click Allow for this website and accept Chrome\u2019s permission request." });
+          return;
+        }
+        if (!msg.allow) await chrome.permissions.remove({ origins });
+        if (!ws.isConnected() || msg.allow && access.stopped) {
+          reply({ ok: false, error: "Access is stopped or disconnected. Reconnect before allowing this website." });
+          return;
+        }
+        const frame = { type: "site_grant", v: PROTOCOL_VERSION, host: normalizeDomainPattern(msg.host), allow: msg.allow };
+        ws.send(frame);
+        if (currentPolicy) await onAllowlist(currentPolicy);
+        reply({ ok: true });
+      })().catch(() => reply({ ok: false, error: "Could not update this website permission. Please try again." }));
+      return true;
     }
     const fromOwnPage = sender.id === chrome.runtime.id && sender.url?.startsWith(chrome.runtime.getURL(""));
     if (msg?.type === "proxy_apply" && fromOwnPage) void syncProxy();
@@ -2833,12 +3771,24 @@
       return true;
     }
     if (msg?.type === "dismiss_blocked" && typeof msg.host === "string") {
-      void chrome.storage.local.get("blockedSites").then(async ({ blockedSites }) => {
+      if (!isApprovalPage(sender)) {
+        reply({ ok: false, error: "Use the extension popup or Settings." });
+        return;
+      }
+      const host = normalizeDomainPattern(msg.host);
+      if (!siteOrigins(host).length) {
+        reply({ ok: false, error: "Invalid website." });
+        return;
+      }
+      void chrome.storage.local.get(["blockedSites", "dismissedSites"]).then(async ({ blockedSites, dismissedSites }) => {
         const still = (Array.isArray(blockedSites) ? blockedSites : []).filter((b) => b.host !== msg.host);
-        await chrome.storage.local.set({ blockedSites: still });
+        const dismissed = Array.isArray(dismissedSites) ? dismissedSites.filter((site) => typeof site === "string" && site !== host) : [];
+        await chrome.storage.local.set({ blockedSites: still, dismissedSites: [...dismissed, host].slice(-100) });
         pendingBlocked = still.length;
         reflectBadge(ws.state);
-      });
+        reply({ ok: true });
+      }).catch(() => reply({ ok: false, error: "Could not dismiss this website. Please try again." }));
+      return true;
     }
   });
   async function healFromHelper() {
@@ -2861,7 +3811,20 @@
       console.warn("[mcp-browser-extension] could not apply the proxy setting", err);
     }
   }
+  var historyInitialized = false;
   async function bootstrap() {
+    await chrome.storage.local.setAccessLevel({ accessLevel: "TRUSTED_CONTEXTS" });
+    await chrome.storage.session.setAccessLevel({ accessLevel: "TRUSTED_CONTEXTS" });
+    await chrome.storage.session.remove("actionRequests");
+    await access.initialize();
+    if (!historyInitialized) {
+      historyInitialized = true;
+      await activity.interrupt().catch(historyFailed);
+    }
+    await initializeBrowserPermissions();
+    await refreshFeatureBadge();
+    const savedClients = (await chrome.storage.local.get(CLIENT_STORAGE_KEY))[CLIENT_STORAGE_KEY];
+    pendingClients = (Array.isArray(savedClients) ? savedClients : []).filter((c) => c.state === "pending" && c.expiresAt > Date.now()).length;
     await chrome.alarms.create(KEEPALIVE_ALARM, { periodInMinutes: 0.5 });
     await syncProxy();
     await reloadIfFilesChanged();